Another option is to put an entry in the syslog.conf file to invoke the script when entries appear. The advantage this has is that it will allow you to exclude some messages (such as boot, kernel messages, mail...) and only handle the class of message you need. (The section on named pipes).
You can also check the section on "Shell execute", which allows the program executed to receive the message as a single parameter. The advantage this one has is that the selected messages will be the only thing passed, and it simplifies the handling (no tail -f problems due to buffering) - Each message is sent independently of the others. The script devolves into the fragment:
if echo "$1" | grep "$string" 1>/dev/null 2>&1
echo "String found on $HOSTNAME" | mail -s "Subject" email@example.com